Introducing constant-time support for LLVM to protect cryptographic code

Summary: Trail of Bits has developed constant-time coding support for LLVM, introducing a __builtin_ct_select family of intrinsics that prevents the Clang compiler from optimizing carefully crafted constant-time code into versions with data-dependent branches. The changes, published as an RFC on the LLVM Discourse forum in August 2025 and still under review for a future LLVM release, lower to cmov on x86-64, CSEL on AArch64, and masked bitwise arithmetic on i386, ARMv7, and other architectures.
Key Takeaway: A study cited here, "Breaking Bad: How Compilers Break Constant-Time Implementations," found compilers break constant-time guarantees in numerous production cryptographic libraries across 19 libraries and five compilers, and timing variations of a few CPU cycles can be exploited with sufficient measurements to recover secrets.

Read the original at Trail of Bits Blog ↗